Amazing example. Blindly doing anything because of Valgrind is bad, but I think a better rule might be "Don't comment out lines you don't understand in a standard cryptography package and then distribute it to users without warning". I don't think a mere "mention of the need for caution" could have saved anyone here. Handcuffs and a straightjacket on the Debian developer might have been required in this case.
This link covers it well:
What can we learn from this? Firstly, vendors should not be
fixing problems (or, really, anything) in open source
packages by patching them locally – they should contribute
their patches upstream to the package maintainers. Had
Debian done this in this case, we (the OpenSSL Team) would
have fallen about laughing, and once we had got our breath
back, told them what a terrible idea this was. But no, it
seems that every vendor wants to “add value” by getting in
between the user of the software and its author.
Secondly, if you are going to fix bugs, then you should
install this maxim of mine firmly in your head: never fix a
bug you don’t understand. I’m not sure I’ve ever put that
in writing before, but anyone who’s worked with me will
have heard me say it multiple times.
"...we (the OpenSSL Team) would have fallen about laughing..."
Note this attitude of derision and arrogance. It's interesting that this was before the quality of OpenSSL code became common knowledge, heartbleed and finally the major work of LibreSSL. I'm not sure if I'd just really like this kind attitude to be a good indicator of trouble coming or it really is so.
This link covers it well:
http://www.links.org/?p=327